Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Back to findings
Known issueKI-MENU-IMAGES-VIPS-NO-TIMEOUT

vipsthumbnail still-image lane has no timeout; a stalled conversion wedges its lane and, when lazy, the shared pool

OpenReviewedMedium

Medium-severity issue, currently open.

Description

The issue as recorded.

generate_thumbnail sends still images to env VIPS_CONCURRENCY=1 vipsthumbnail without a timeout (bin/omarchy-menu-images:199). The video lane wraps ffmpegthumbnailer in timeout -k 5 10. A still that stalls vips holds its lane forever. A corrupt or pathological file, or a path on a stalled mount, can cause the stall. An eager open, without --lazy-thumbnails or with --cache-only, waits for its whole fan-out before the picker opens. So one stalled still blocks that open. Lazy opens queue their stills for one shared background pool per rows cache (upstream #14117). The pool runs at most two converters and finishes each batch before it takes the next. So a stalled still holds the pool, and stills that later opens queue get no thumbnail while the stall lasts. Each later open queues the stalled still again, so a freed lane can stall again. At 393a43d4 each lazy open started its own generators, and later stills still converted. The generator holds the content-hash lock while its converter runs. The converter does not inherit the lock, so a killed generator frees it even when the converter hangs. A duplicate job for the stalled file waits 30 seconds on that lock and then gives up. The damage is lost lanes and missing thumbnails, not a lock deadlock.

Affected requirements

The requirement(s) this issue violates — click through to the spec.

Severity, explained

Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).

MediumRated severity — the impact if this issue is exploited or hit.
why this rating
Risk-rated
risk area
Availability
Security classification
Not a security surface
CVE surface
None

Where it is

The code the issue lives in — peek the affected function inline to see it in context.

  • bin/omarchy-menu-images still-image thumbnail lane

How it's proven

The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.

Known issue reproducedprofileknown_issue_reproducerprovesSW-REQ-260929-THMB
Reproducer test
Run it yourself
./pocs/menu-images-vips-still-no-timeout.sh
Covers (2)
Last run Oct 4, 2026, 10:36 PM

Reproduction steps

Technical steps for your engineers to confirm the issue by hand.

./pocs/menu-images-vips-still-no-timeout.sh

What protects you, and the fix

What limits your exposure today, and the planned remediation.

What protects you now

timeout -k 5 10 bounds the video lane. The converter does not inherit the content-hash lock, so a killed generator frees the lock. Lazy conversions run in at most two lanes at lowered CPU and I/O priority, so a stalled converter competes less with the desktop. Manual recovery is to kill the stalled vipsthumbnail process and to move a still that stalls again out of the directory.

The fix

Wrap the vipsthumbnail invocation in timeout (matching the video lane) or add an async kill to the generator. Then close this KI and flip the THMB deferral

Blast radius

If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.

Tracing blast radius…

Touch this finding and you re-check 1 requirements · 1 code files · 1 tests.

Requirements (1)
Code files (1)
  • omarchy-menu-images
Tests (1)
  • menu-images-test.sh

Per-requirement evidence

For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.

Implementing code (1)
  • bin/omarchy-menu-images
Tests & evidence (1)
  • test/shell.d/menu-images-test.sh
Proof obligations (1)
external_call_timeout_bounded

Every cross-process call shall declare connect, read, and total deadlines; no external call is defaulted to "no timeout."

  • ✗nominal (required)

Evidence trail

The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.

  • proof/evidence/ki-menu-images-vips-no-timeout.yaml

Change history

Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.

Discussions

Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

Sign in to discuss this with the proof team.Sign in